Out-of-bounds write in Pillow - CVE-2026-25990

Vulnerability identifier: #VU123113

CSH Severity: High

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-25990

CWE-ID: CWE-787

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when loading PSD images. A remote attacker can trigger an out-of-bounds write and execute arbitrary code on the target system.

Pillow
Debian Linux
Anolis OS
openEuler
Ubuntu
Fedora
Fusion Content-Aware Storage
Maximo Application Suite - Monitor Component
Maximo Application Suite - Visual Inspection Component
Data Cataloging
IBM Fusion HCI
IBM Maximo Application Suite
Oracle Financial Services Compliance Studio
python3-pillow-help
python3-pillow-tk
python-pillow
python-pillow-debuginfo
python-pillow-debugsource
python3-pillow
python3-pillow-devel
python3-pillow-qt
python3-pillow-doc
pillow (Debian package)
pillow (Ubuntu package)

Install updates from vendor's website.

Pillow - update to 12.1.1
Fusion Content-Aware Storage - update to 1.1.5
IBM Fusion HCI - update to 2.13.0
IBM Maximo Application Suite - addressed in versions 8.10.36, 8.11.33, 9.0.22, 9.1.11
Maximo Application Suite - Monitor Component - addressed in versions 8.10.29, 8.11.27, 9.0.19, 9.1.9
Maximo Application Suite - Visual Inspection Component - update to 9.1.17
Data Cataloging - update to 2.5.3
python3-pillow-help - update to 10.3.0-2
python3-pillow-tk - update to 10.3.0-2
python-pillow - update to 10.3.0-2
python-pillow-debuginfo - update to 10.3.0-2
python-pillow-debugsource - update to 10.3.0-2
python3-pillow - update to 10.3.0-2
python3-pillow-devel - update to 10.3.0-2
python3-pillow-qt - update to 10.3.0-2
python3-pillow - update to 10.3.0-2
python3-pillow-devel - update to 10.3.0-2
python3-pillow-qt - update to 10.3.0-2
python3-pillow-tk - update to 10.3.0-2
python3-pillow-doc - update to 10.3.0-2
python-pillow - addressed in versions 11.1.0-3.fc42, 11.3.0-7.fc43
pillow (Debian package) - update to 11.1.0-5+deb13u1
pillow (Ubuntu package) - update to 11.3.0-1ubuntu1.1

• https://github.com/python-pillow/Pillow/security/advisories/GHSA-cfh3-3jmp-rvhc

• Out-of-bounds write in Pillow
• Ubuntu update for pillow
• Fedora 43 update for python-pillow
• Fedora 42 update for python-pillow
• Debian update for pillow
• openEuler 24.03 LTS SP3 update for python-pillow
• openEuler 24.03 LTS SP2 update for python-pillow
• openEuler 24.03 LTS SP1 update for python-pillow
• openEuler 24.03 LTS update for python-pillow
• Anolis OS update for python-pillow
• IBM Maximo Application Suite - Monitor Component update for Pillow
• Multiple vulnerabilities in IBM Maximo Application Suite
• Out-of-bounds write in Oracle Financial Services Compliance Studio
• IBM Maximo Application Suite - Visual Inspection Component update for Pillow
• Multiple vulnerabilities in IBM Fusion, IBM Fusion HCI, IBM Fusion Data Cataloging and IBM Fusion Content-Aware Storage